The Scam Archive

Real examples, plainly explained. Search by scam, sender, domain, or phone number and learn the red flags before you click.

Browse all scams Report a scam
Plain language
No jargon
Real screenshots
Not mockups
Shareable tips
Family-friendly

Search the Archive

AI search powered by Algolia

Latest additions

Newest examples in the archive, with the screenshot from each report.

See full archive
Unknown SharePointMicrosoft

Fake SharePoint shared documents page that asks for your email password to download business files

A page styled as Microsoft SharePoint shows a "Shared Documents" folder with five business files, such as product spreadsheets, a company profile and delivery requirements, each with a blue Download button. A notice above the files says they are "sensitive and secured" and that to open them you must "provide your correct email credentials" so the page can connect to "your email provider through a secured IMAP channel". It was first observed in India on November 2, 2026, at arch-zhp[.]pages[.]dev, a free Cloudflare Pages address that does not belong to Microsoft, and was seen three times that day.

Read more
Part of Documents Ready To Sign Scam
Unknown SteamCounter-Strike 2

Fake Steam Workshop page asking you to vote for a Counter-Strike 2 skin that opens its own login window

A page copies the Steam Workshop page for a fan-made Counter-Strike 2 weapon skin, "AWP | Ancient Heritage", with the Steam logo and menus, item pictures, award icons, a visitor counter and the question "Would you like to see this item officially accepted and supported in Counter-Strike 2?" with a Yes button. The description ends with "Don't forget to Vote and Favorite". The page title spells Steam with look-alike letters, and the page code opens its own login window when certain buttons are clicked. It was last seen in Sweden on November 1, 2026, at store.communityartsections[.]com, a domain registered three days earlier. The same page code was seen in El Salvador on October 15, 2026, at store.communitydevelopers[.]shop, and was first observed on August 3, 2026, at store.poweredappsource[.]shop with a different skin. None of these addresses belong to Steam or Valve.

Read more
Part of Fake Game Item Vote Login Scam
Unknown PhilippinesWalang Gutom

Fake Walang Gutom food stamp registration form promising a ₱5,000 rice subsidy

A Blogger blog called "RICE SUBSIDY AT P5K" carries a post headed "WALANG GUTOM PROGRAM", "FOOD STAMP CARD" and "ONLINE REGISTRATION FORM", using the name of the Philippine government's real Walang Gutom food stamp program. The form asks for your full name, mobile number, email, island group, region, province, city, barangay and street, the type of valid ID you hold and the people in your household. It was first observed in the Philippines on November 1, 2026, at ricesubsidyonlineregistrationform.blogspot[.]com, which is not a government website.

Read more
Part of Fake Government Aid Registration Form Scam
Unknown PolandŻabka

Fake Żabka Halloween survey promising a 1,000 zł gift card if you share it with friends

A Polish-language page posing as Żabka Polska, the convenience store chain, opens with "Gratulacje!" and offers a chance to get a 1,000 zł gift card for answering a four-question Halloween survey. Its banner lists three steps: take part, fill in a short survey, and share the page with friends on social media, shown with Facebook, Instagram, TikTok and Messenger icons, before you "collect your Żabka gift card". Below it, comments posted minutes apart say the writers already won. It was first observed in Poland on November 1, 2026, at biqbo[.]com, an address that does not belong to Żabka. The same page code and analytics ID were used on 13 other addresses since August 2026 for gift quizzes in the names of Pick n Pay, La Colonia, Mi Comisariato, Alfamart, Indomaret and SilverQueen.

Read more
Part of Share-to-Unlock Prize Scam
Unknown AdobeInvoice

Blurred Adobe invoice behind a login box that asks for your email password

A page titled "Invoice Portal" shows a blurred Adobe invoice in the background, with an amount due, an agreement number and payment instructions that cannot be read. On top of it, a box says "This is a permissions-based security document" and asks you to "Log in using your email address" with your email and password. It was first observed in Egypt on October 31, 2026, at titan-invoice[.]surge[.]sh, a free web hosting address that has nothing to do with Adobe. The page code sends what you type to a Discord chat channel.

Read more
Part of Documents Ready To Sign Scam
Unknown Fake InvestmentCrypto

Digital Gold crypto investment site promising up to 9.5% profit a day

A website called Digital Gold describes itself as "a United Kingdom registered investment firm" working in crypto, forex and crypto mining. It offers three plans that promise 2.00%, 5.00% or 9.50% profit every day, with minimum deposits from $100 to $15,000. It shows the logos of Blockchain.com, Binance, Coinbase, Wave and Grayscale, reviews that claim profits within 48 hours and "over 100,000 dollars", and live statistics that claim 7,973 running days. It was first observed in India on October 31, 2026, at digital-gold[.]vip. The site links a certificate of incorporation for "UPBIT MINNER LTD", company number 14728395, but the UK Companies House register lists that number under a different company, and the site's own contact address is in New York, United States. The domain was registered on July 25, 2026.

Read more
Part of Fake Crypto Investment Platform Scam
Unknown CDEKRussia

Fake CDEK tracking page telling a seller that money from a buyer is waiting

A Russian-language page copies the CDEK (СДЭК) parcel tracking page under the heading "Отследить отправление" (track a shipment). It shows an order for "Наушники AirPods Max" (AirPods Max headphones) with the status "Заказ оплачен" (order paid) and "Получение средств" (receiving funds), hides the delivery address behind "подтвердите заказ для отображения" (confirm the order to display it) and shows "К получению" (to receive) 10 000 ₽ with a green "Получить" (receive) button. It was first observed on October 31, 2026, at order89298[.]rest, an address that does not belong to CDEK and was two days old at the time.

Read more
Part of Fake Delivery Service Payout Page Scam
Unknown AirtelIndia

Fake Airtel Diwali gift page promising ₹2,000 cash to everyone

A Hindi-language page with the Airtel name and logo wishes visitors a happy Diwali and says a ₹2,000 cash reward is available for everyone. It shows a festive banner with a "अभी पाएं" (get it now) button, a like counter and a list of comments from people who say the money reached their account and that they shared the page in all their WhatsApp groups. It was first observed in India on October 31, 2026, on short, random-looking .buzz addresses such as mgojd[.]buzz, wmbry[.]buzz and qcoph[.]buzz, none of which belong to Airtel. The same page code was used in August 2026 for a Pakistan Independence Day "cash gift" on other .buzz and .xyz addresses.

Read more
Part of Share-to-Unlock Prize Scam
Unknown AlgeriaRevolution Day

Fake Revolution Day page promising 60GB of free mobile data to everyone in Algeria

An English-language page uses Algeria's Revolution Day to say that 60GB of free mobile data has been prepared for everyone to claim. Its banner shows the logos of the three Algerian mobile networks, Ooredoo, Djezzy and Mobilis, with the words "FREE DATA FOR EVERYONE", and below it a "View Now" button, a like counter and comments from people who say they received the data and are sharing the page with family and friends. It was first observed in Algeria on October 31, 2026, at axfuj[.]buzz, and was seen that same day at gsdjl[.]buzz. Neither address belongs to any of the three networks. The page uses the same code as fake Airtel Diwali cash gift pages seen in India and a Pakistan Independence Day cash gift seen in August 2026.

Read more
Part of Share-to-Unlock Prize Scam

Latest WatchOut alerts

Recent warnings. When an alert matches a scam record or a domain already in the archive, a link to that record is included.

All alerts

Browse by category

Categories with examples in the archive, and how many records each one has.

View all
P

Phishing

Attempts to trick victims into revealing credentials or sensitive info by impersonating trusted services.

18 scams

R

Refund / Invoice Bait

Fake invoices or 'refund' notices that trick victims into calling scammers or installing remote-access tools.

4 scams

T

Tech Support / Remote Access

Scammers claim there is a virus or issue and request remote access or payment for fake fixes.

1 scam

I

Investment / Crypto

Fraudulent investments or crypto scams promising guaranteed returns or exclusive offers.

4 scams

R

Romance / Dating

Emotional manipulation via dating platforms leading to requests for money or gifts.

1 scam

M

Marketplace / Classifieds

Fake listings, rental scams, or overpayment schemes on marketplaces and classifieds.

4 scams

J

Job / Work-From-Home

Fake job offers requiring upfront fees, equipment purchases, or acting as a money mule.

5 scams

A

Advance Fee Fraud

Scammers promise a large payout, inheritance, contract transfer, or released funds, then demand fees, bank details, or identity documents before the money can be received.

4 scams

L

Lottery / Prize

Fraudulent prize claims requiring fees or sensitive info to claim winnings.

2 scams

C

Charity / Disaster Relief

Fake charities exploiting disasters or tragedies to solicit fraudulent donations.

1 scam

S

Shipping / Delivery

Fake delivery notifications tricking victims into clicking malicious links or paying fees.

3 scams

I

Impersonation / Social Media

Accounts or pages impersonating individuals or brands to defraud followers.

3 scams

S

Smishing (SMS Phishing)

Phishing attempts delivered by text message linking to fake sites or requesting responses.

2 scams

E

Extortion / Sextortion

Threats to expose sensitive or fake compromising information unless paid.

2 scams

M

Malware / Attachment

Emails or downloads containing malicious attachments or links to malware.

3 scams

C

Credential Harvesting

Fake websites or forms designed to steal login details, MFA codes, or personal data.

5 scams

C

Crypto Wallet / Exchange Impersonation

Fake crypto wallets, exchanges, or airdrops designed to steal private keys or funds.

3 scams

Quick tip: Pause before you pay

Unexpected refunds, gift-card demands, and urgent invoices are classic pressure tactics. Verify using a trusted phone number or website you already know, not the link you were sent.

See common red flags

About the Archive

Who we are, how we verify examples, and how you can help.

Report a Scam

Send screenshots or details. Your tip could protect someone else.

Support Our Work

Donations to the Cybersecurity Reach Foundation keep this archive free.